Privacy Policy

1. Who we are

MyBalancr is a personal budgeting tool that helps you track bills and income. We are based in the Netherlands. If you have questions about this policy, contact us at privacy@mybalancr.com.

2. What data we collect

We collect only what is necessary to provide the service:

• Account data: your email address and a hashed password (PBKDF2-SHA256 with random salt and 100,000 iterations).
• Financial data: bill names, amounts, and cadences you enter. Income sources you add. This data is visible only to you. Bill names, memos, amounts, and income names and amounts are encrypted at rest using AES-256-GCM before being stored. Dates, cadences, categories, and other metadata are stored unencrypted.
• Payment data: processed entirely by Stripe. We store only your Stripe customer ID and subscription status — we never see your card number.
• Session data: a signed cookie used to keep you logged in. No tracking cookies.

3. How we use your data

Your data is used solely to provide and improve the MyBalancr service: showing your dashboard, processing payments, and sending transactional emails (verification, password reset, billing alerts). We do not sell, share, or use your data for advertising.

4. Third-party services

• Supabase (database hosting) — data stored in EU region.
• Stripe (payment processing) — subject to Stripe's privacy policy.
• Resend (transactional email) — used only to deliver emails you triggered.
• Cloudflare (hosting & analytics) — anonymised page-view analytics with no cookies. Subject to Cloudflare's privacy policy.

Some processors (Stripe, Cloudflare) may process data outside the EU/EEA. These transfers are protected by Standard Contractual Clauses approved by the European Commission, in accordance with GDPR Chapter V.

5. Your rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and all associated data — available directly from Settings → Delete account.
• Export your data (contact us).
• Object to processing or withdraw consent.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl if you believe we are not complying with data protection law.

To exercise any of these rights, email privacy@mybalancr.com. We will respond within 30 days.

6. Data retention

When you delete your account, your personal data (email, bills, incomes, sessions) is removed from our systems immediately. Your Stripe customer record is deleted from Stripe at the same time, but Stripe retains invoice records for 7 years as required by Dutch accounting law (these contain your name, email, and amounts charged but no card details). Email delivery logs at our email provider Resend are retained for up to 30 days for deliverability and abuse prevention. To prevent abuse of free trials, we retain a hashed version of email addresses that have used a trial. This is technically still personal data under GDPR but cannot be used to contact you and is retained on the basis of legitimate interest (Article 6(1)(f)).

7. Cookies

We use a session cookie to keep you logged in (expires after 7 days) and a preferences cookie to remember your display currency (expires after 1 year). Neither contains tracking data. We use Cloudflare Web Analytics, which sets no cookies.

8. Changes to this policy

If we make material changes we will notify you by email and update the date at the top of this page.